Mark parts of strings as unsafe?That's not marking as "unsafe", that's marking as "data". It is not "resafed" in some way (well, in some DB drivers it is, because driver offloads responsibility to DB itself, but that's not the point), it is simply treated completely differently. That's not even comparing apples and oranges - more likely bicycles and tables.

Best practices for handling computer viruses@AJHenderson, well then, if it that advanced it might as well already infected every PC on your LAN through 0-day vulnerability. How can you be sure that your re-image helped? So, let me ask this question straight: "you've found Trj/Cookie.A on single PC, will you nuke your entire network of 100+ PCs"?

Best practices for handling computer viruses@wcypierre, this would again be described in malware description. However if you wish to argue about "yet unknown effects", how can YOU be sure that RIGHT NOW your PC is not infected with super-stealthy malware controlling all your online life and that you not need to re-image RIGHT NOW? How can you be sure that it didn't stealth-copy itself to your image either? Can we please talk about practice and not rituals with imaginary begins (does that remind you of anything)?

How can I explain SQL injection without technical jargon?@CrisStringfellow, get technical explanation s/cursor/robot/g, s/db/warehouse/g. That's pretty much all this explanation does. It is exactly same as "techie", it just uses less "frightening" words, so people won't automatically shut off brain even before trying to understand it.

Oct14

comment

Known password length, brute force character in place?Please read it carefully yourself. Let me cite it for you: "Our analysis of network jitter used a custom application on an unloaded server.". Those values were received on custom lightweight protocol with careful fine-tuning of network card and CPU and zero load on client and server and explicitly talks that it is impossible on any real server with random CPU/network load and standard protocols.

Oct13

comment

Known password length, brute force character in place?No matter how much you try you simply can't "average" delay that is 10+ orders larger than what you want to measure. First paper talks about HMAC, not plain text and 20ms, just as I've already said is billions time more than it takes to compare two plain-text strings.

Oct12

comment

Known password length, brute force character in place?I call this "you can compare plain-text timing over internet" bullshit. Are you aware that byte-to-byte comparison of plain text hardly even takes 0.00000000001 second? How you propose to compare it with 0.001s delay even on LAN, with real WAN delays around 0.1-0.5s with huge (compared to comparison time) fluctuation between those?

Sep11

comment

Unauthorized activity on port 3389You don't "detect activity on port 3389" with mouse movements. You do it with monitoring tools. Do you have any related output of those or do you automagically assume "mouse movement = scary cracker on RDP"?

Sep11

comment

How to check if someone is in my computerIs you mouse wireless? If you only experience random mouse movements, I'd first think about either interference, dirty optical sensor or any other mechanical damage to the mouse, not about someone strange that enjoys controlling your PC just to randomly move mouse.